Another blog to help expand Security Knowledge
Introduction Microsoft Sentinel has solutions, under Content hub, that can be used to install multiple Microsoft Sentinel resources at one time. These resources include This makes is much easier to install what you need when you need it. With the upcoming change coming so that all the out-of-the-box content is moving to solutions (see Out-of-the-box […]
Introduction In my last blog post (Extract Microsoft Sentinel MITRE information to CSV file – Yet Another Security Blog (garybushey.com)) I went over a PowerShell script that will extract the information from the MITRE ATT&CK page in Microsoft Sentinel. In this post I am expanding on that script with two new parameters ShowZeroSimulatedRuleTemplates ShowAllSimulatedRuleTemplates This […]
Introduction Microsoft Sentinel has a great MITRE ATT&CK page that shows you which tactics and techniques are being covered by your rules. It looks like the image below (this is from a new MS Sentinel instance, so I don’t have any rules enabled) It would be great to get this information into a CSV file […]
Introduction There may be times when you have a complicated query that you use in your Microsoft Sentinel workbook that you want to re-use and only filter to show one specific row. Rather than re-running the query, I will show you how to use the “merge” data source in a query step to re-use the […]
Introduction Did you know you can call a Microsoft Sentinel playbook from a workbook against an existing incident? It is actually quite easy to do, and this post will go into the details a bit more. ARM Actions One of the options available to use when you add a link to the “ARM Action” (currently […]
This is just a short blog post about the MS Sentinel incident’s workbooks. If you go to the Incidents page in MS Sentinel, there are two workbooks that are linked. The first is the “Security efficiency workbook” in the header bar and the second is the “Incident Overview” workbook that shows up the incident’s detail […]
Overview Another Saturday, another blog post. In a completely unrelated note, I really miss Saturday morning cartoons đŸ™‚ I was watching the latest Microsoft Security Insights show (Microsoft Security Insights Show Ep. 103 – YouTube) and saw some workbooks that Jing Nghik had created. In one spot he showed a spot where a workbook could […]
Overview I recently saw a question about how to do a drilldown in a Microsoft Sentinel workbook. While Rod Trent wrote a post called How to Make Your Azure Sentinel Workbooks Even More Interactive with Drilldowns and Downloads – Azure Cloud & AI Domain Blog (azurecloudai.blog) about 2 years ago on this subject, it deals […]
Overview Back in the first post in this series, I mentioned that you can easily change how far back you can look to get information in your queries. This post will talk about PowerBI parameters that we will use to do this. Create a parameter Parameters are very easy to create. In left hand navigation […]
Overview So far in this series (if 3 posts can be considered a series), we have ingested data into PowerBI and created a basic report. We looked at some of the pitfalls that may happen when creating a table view. In this post, we will look at the tables themselves and how we can expand […]
